1d4dcaf2b07cab6f785c4607040b90d2e87a2d94c3368dd57f89c97a6d77bbe3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.14021.5418.dll
Size

17.4MB
MD5

078996597686e5b1777869045dc340dc
SHA1

f308bb3531571d624cd98799c6cf6774f18a5f38
SHA256

1d4dcaf2b07cab6f785c4607040b90d2e87a2d94c3368dd57f89c97a6d77bbe3
SHA512

7c033965c70731d7bbebf9966e4cfc0804a2b41933fac8f440f6b2c992781f13574b5ad1227da9484d88f2c7d74898a432f99fb5f3c0759564feea10b1a49371
SSDEEP

393216:P1qGMMtyaJYWrILsMA8xdp+1hmQ8OHwtBbEE9jb4:P1nttH38LsMA8xd1Dl4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\LOG\rundll32.exe.DEBUG.log	rundll32.exe
File created	C:\Windows\SysWOW64\LOG\rundll32.exe.DEBUG.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2732	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2252 wrote to memory of 2732	2252	rundll32.exe	28
PID 2732 wrote to memory of 2656	2732	rundll32.exe	29
PID 2732 wrote to memory of 2656	2732	rundll32.exe	29
PID 2732 wrote to memory of 2656	2732	rundll32.exe	29
PID 2732 wrote to memory of 2656	2732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.14021.5418.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.14021.5418.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 300
    3⤵
    - Program crash
    PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000002160000-0x00000000032E2000-memory.dmp

Filesize
17.5MB

Download
memory/2732-2-0x0000000002160000-0x00000000032E2000-memory.dmp

Filesize
17.5MB

Download
memory/2732-3-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2732-4-0x0000000002160000-0x00000000032E2000-memory.dmp

Filesize
17.5MB

Download
memory/2732-6-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2732-8-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2732-10-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2732-9-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2732-11-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2732-26-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2732-24-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2732-21-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2732-19-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2732-16-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2732-14-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2732-29-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2732-31-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2732-39-0x0000000002160000-0x00000000032E2000-memory.dmp

Filesize
17.5MB

Download